The economic disruptions wrought by COVID-19 have highlighted the importance of a secure digital presence for both government and businesses, innovation experts are arguing. 

The Digital ID and Authentication Council of Canada (DIACC), a non-profit dedicated to building a digital identification and authentication framework, has recommended in its 2021 pre-budget submission that “all Canadians have access to an ISO compliant government-issued digital ID credential with economy-wide utility by December 31, 2021.” 

According to DIACC, a digital identity is key to making the services that have been so vital during the COVID-19 pandemic — health care records and banking information, for example — more accessible in a secure and transparent way. 

“The digital identity is not just a nice-to-have convenience, but it is a core requirement in a digital-first economy,” says Joni Brennan, president of DIACC. “The COVID pandemic has really pushed the digital space forward by five years, if not more. It has forced businesses, governments and individuals to speed up digital transformation.”

As more people move online to access services, the need for more robust security of people’s information is also growing. “It's not good enough anymore to ask these super secret questions...it's not good enough anymore to have a four-digit password,” says CJ Ritchie, chief information officer and associate deputy minister at the government of British Columbia, as well as a DIACC board member. 

This is something that Greg Wolfond, CEO of SecureKey, has been thinking about and helping to implement for several years through his company's digital identity services. Verified.Me, one of SecureKey’s products, verifies identity by connecting with an individual’s trusted institution — such as a bank, with the customer’s consent — in order to verify identity and access services like their Canada Revenue Agency account. 

“Bad folks know how to get a picture of my driver's license and do a deep fake video, where they're actually on a video call with a call centre and they can pretend that they're me talking to the agents,” says Wolfond. 

SecureKey already counts all five major Canadian banks among its partners, and is working to add more, including telco providers, as having multiple points of verification makes the ID more secure. Wolfond says a combination of provincial ID working with banking and telco identification is where the company sits. 

“[It’s] very hard to replicate the security of a bank login or a telco check on a device or an Equifax fraud engine,” says Wolfond. “They're costing organizations hundreds of millions of dollars a year to make them run.”

Digital identity in practice

Brennan notes other ways that a digital identity could function, such as with specific identity credentials for different transactions. British Columbia's Services Card, for example, allows access to both health services and government services, and can be used as a photo ID. It’s a physical card, but it also includes a mobile app that people can use to log onto government services. 

“We want those credentials to be able to be reused and reusable, where appropriate,” says Brennan. “The ideal is that if, for example, you had a provincial digital identity that was issued to you, you should be able to reuse that for your health credential. Because technically, to get your health care in your province, you have to establish a residency, so your health credential would build off your residency in that province.”

This approach echoes the way that digital identity works in Estonia, regarded as a pioneering country in digital identity. In 2014, Estonia launched E-Residency, allowing entrepreneurs to start an EU company online from anywhere in the world. 98 percent of Estonians have an online ID card, which includes 384-bit ECC public key encryption and embedded files that can act as a national health insurance card, bank verification, voting verification and legal travel ID simultaneously. 

Wolfond thinks that Canada has great potential to build a digital ID, thanks to our institutions’ collaborative nature. 

“The [Canadian] banks got together early on and said, let's have a debit network, even though we compete,” he says, referring to Interac. “It's not every place in the world ... that a bunch of institutions say, 'Hey, this is not going to move the bottom line, but it's important to do as a country.’”

The problem of access

DIACC knows that a digital identity for all Canadians is an ambitious goal, but Brennan hopes that Canadians can get access to at least one government-issued digital ID by 2021. Infrastructure poses a challenge, however. Currently, 63 percent of rural households in Canada do not have access to internet speeds considered standard by the CRTC. 

While the federal government continues to invest in broadband networks across Canada — last year, Ottawa promised up to $6 billion in rural broadband over the next 10 years — providing a digital ID to as many people as possible could still mean increasing access to services for those who aren't in a position to get a digital ID. For example, in the early days of the pandemic, Brennan says, government phone lines were overwhelmed with people trying to get information. A digital ID could provide a "load balancing" effect so some could access information online, while others who need to use alternatives like the phone could more easily do so.

“If we can get some or most access, then we'll definitely help the people and organizations who really do need to rely on the phone right now,” says Brennan. “I think that we have to have these kinds of stretch goals, in order for us to get to the place where we absolutely have to be for a truly digital Canada.”

One thing stressed by all three experts who spoke to Research Money: the importance of collaboration between the public and private sectors. It would be costly for one organization to create a digital ID, says Brennan, but a coordinated effort between the federal and provincial governments and private companies could create an ecosystem around digital ID.  

“The government doesn't corner the market on the creation of public value,” says Ritchie.

“A successful launch means collaborating with private sector entities because that's where the transactions happen.”

Building a framework for trust

Anticipating the need for digital identity, DIACC has spent the last four years working with the Pan-Canadian Identity Management Sub-Committee (IMSC) on the Pan-Canadian Trust Framework (PCTF), a forum consisting of the Public Sector Chief Information Officer Council (PSCIOC) and the Public Sector Service Delivery Council (PSSDC), along with private-sector partners. The framework is meant to standardize processes related to digital identity, specifying the standards that ensure privacy and security, and allowing interoperability between providers.

“If we can get some adoption around this common data model, then it's okay to have networks that are built on different technologies,” says Brennan. “That means that I'll be able to use my credential in network A, B or C, even though they may be built on [different] technology. As long as they're all issuing and accepting that common data model, I can use my credential in that ecosystem.”

DIACC plans to release its first “minimum viable product” of the PCTF this month, outlining the requirements needed to implement it, and alpha test the principles outlined in the framework beginning in November. 

While it will reference technology that can be used as verifiable credentials, it won’t specify the technology that must be used, since it is always evolving, Brennan says. “But the framework is pointing to the kinds of technologies that are recommended for particular risk profiles for particular transactions.”

DIACC will look to broaden the scope of the PCTF based on market needs and desires. “One of the most important pieces will be the ability for those networks to issue and consume on a common data model,” says Brennan. 

Besides building the technology, educating citizens on what a digital ID can do — and why citizens can trust it — will also be part of its rollout. 

“It's not just about citizens doing business with the government — it’s about citizens participating in a digital economy,” says Ritchie.  

Ritchie says an awareness campaign will be required, and digital IDs can also be part of instilling confidence in democracy by enabling secure online voting. Nearly half of Estonians used online voting in the European Parliament in 2019. 

“Digital ID isn't something that most Canadians are asking for. They don't even know what's in the realm of the possible,” says Ritchie. “What they're asking for is that they want their lives to be easier, more convenient, secure and safe.”

R$